CVSS vs CVE vs CWE vs EPSS: How Vulnerability Labels Differ
Many teams believe a CVSS score of 10 means “patch this first.” Not always. The CVSS vs CVE confusion is where bad prioritization starts: a CVE names a vulnerability, CVSS rates its severity, CWE describes the weakness behind it, and EPSS estimates how likely it is to be exploited. Each answers a different question.
CVSS vs CVE: What Is the Difference?
A CVE is a unique ID that names one specific publicly known vulnerability, while CVSS is a 0 to 10 score that rates how severe that vulnerability is. CWE describes the type of weakness behind it, and EPSS estimates the probability it will be exploited in the next 30 days.
The Four Labels at a Glance
| Label | Question it answers | Format | Maintained by |
|---|---|---|---|
| CVE | Which vulnerability is this? | ID such as CVE-2021-44228 | CVE Program, run by MITRE with CISA sponsorship |
| CWE | What kind of weakness caused it? | ID such as CWE-79 | MITRE |
| CVSS | How severe is it? | Score 0.0 to 10.0 | FIRST |
| EPSS | How likely is exploitation soon? | Probability 0 to 1 | FIRST |
| CISA KEV | Is it being exploited now? | Yes or no list | CISA |
The Four Vulnerability Labels Explained
CVE: The ID for a Specific Vulnerability
A CVE (Common Vulnerabilities and Exposures) record gives one vulnerability in one product a unique identifier, so vendors, scanners and security teams all refer to the same thing. Our guide to the CVE full form covers how IDs are assigned and how the NVD enriches them.
CWE: The Category of Weakness Behind It
CWE (Common Weakness Enumeration) is a catalog of software and hardware weakness types, such as cross-site scripting (CWE-79) or SQL injection (CWE-89). It describes the root cause, not a specific product.
CVSS: How Severe the Vulnerability Is
The Common Vulnerability Scoring System rates technical severity based on factors such as how the flaw is reached, how complex the attack is, whether privileges or user action are needed, and the impact on confidentiality, integrity and availability.
EPSS: How Likely It Is to Be Exploited
The Exploit Prediction Scoring System, also run by FIRST, uses data on real-world exploitation activity and vulnerability details to estimate the probability that a CVE will be exploited in the next 30 days.
CVE vs CWE: Instance vs Root Cause
Think of CWE as the type of mistake and CVE as a specific occurrence of it. Thousands of CVEs map to CWE-79, cross-site scripting, across different products. Tracking CWEs in your own code shows which mistakes your developers repeat, which is useful for training and secure coding standards.
How CVSS Scores Work (v3.1 and v4.0)
CVSS v3.1 combines base, temporal and environmental metrics. FIRST released CVSS v4.0 in November 2023, renaming the temporal group to “threat,” adding supplemental metrics, and refining how attack requirements and user interaction are scored. Both versions remain in use, so check which one a score uses.
CVSS Severity Ratings
- None: 0.0
- Low: 0.1 to 3.9
- Medium: 4.0 to 6.9
- High: 7.0 to 8.9
- Critical: 9.0 to 10.0
Why Vendor and NVD CVSS Scores Sometimes Differ
Vendors, the NVD and other CVE numbering authorities may score the same CVE differently because they interpret the metrics or deployment context differently. Most published scores are base scores only; your environment can make a flaw more or less serious.
CVSS vs EPSS: Severity vs Likelihood
CVSS tells you how bad exploitation would be. EPSS tells you how likely it is. A critical CVSS score with a very low EPSS probability may be less urgent than a high-severity flaw that attackers are actively targeting.
How EPSS Works
EPSS is a model that FIRST updates regularly, producing a daily probability and percentile for each published CVE. A percentile shows how a CVE compares with all others.
Limitations of EPSS
EPSS does not know your environment, does not measure impact, and only covers CVEs. It reflects observed exploitation patterns, so brand-new vulnerabilities may score low before attack data exists.
Where CISA KEV Fits In
CISA’s Known Exploited Vulnerabilities (KEV) catalog lists CVEs with reliable evidence of active exploitation. Under Binding Operational Directive 22-01, US federal civilian agencies must fix KEV entries by set deadlines, and CISA urges every organization to use the catalog for prioritization. KEV answers a different question from EPSS: not “how likely,” but “it is happening.”
One Vulnerability, Four Labels (Worked Example)
Log4Shell in Apache Log4j shows how the labels combine:
- CVE: CVE-2021-44228
- CWE: mapped by the NVD to weaknesses including CWE-502 (deserialization of untrusted data) and CWE-917 (expression language injection)
- CVSS: 10.0, critical, in v3.1
- EPSS: among the highest exploitation probabilities of any CVE
- KEV: added by CISA in December 2021
Here every label points the same way. Often they do not, which is why using them together matters.
How to Prioritize Patching With CVSS, EPSS and KEV
- Patch anything in CISA KEV first, especially if internet-facing.
- Next, high EPSS plus high CVSS on exposed systems.
- Then high CVSS with low EPSS, on a normal patch cycle.
- Adjust for context: asset criticality, exposure, data sensitivity and compensating controls.
- Track CWEs in your own software to fix root causes, not just symptoms.
US and UK Notes (NVD, CISA KEV, NCSC, Cyber Essentials)
The NVD has faced a backlog in enriching CVEs since 2024, so some records lack NVD CVSS scores or CWE mappings for a time; vendor or CISA scores can fill gaps. In the UK, Cyber Essentials requires high-risk and critical security updates, defined using CVSS 7.0 or above or vendor ratings, to be applied within 14 days. The NCSC advises patching quickly and prioritizing exploited vulnerabilities.
Beyond CVSS vs CVE: Where Prioritization Is Heading
The direction is clear: move from severity alone toward risk. Expect wider use of CVSS v4.0 threat metrics, EPSS, KEV and asset context together in scanning tools. Teams that understand the CVSS vs CVE vs EPSS difference today will spend less time chasing scores and more time fixing what attackers really use. For help building a risk-based patching process, contact Cyber Security Solutions Ltd through our contact page.
FAQs
Yes. A CVE ID can be published before anyone scores it, and NVD enrichment delays mean some CVEs wait weeks or longer for an NVD score. Vendors or the assigning numbering authority often provide their own CVSS score, and CISA has added scores for some records. Check multiple sources when a score is missing.
No. CVSS scores individual vulnerabilities, which are CVEs, not weakness categories. CWE is a classification of root causes. MITRE publishes a separate CWE Top 25 Most Dangerous Software Weaknesses list, based on how often weaknesses appear in CVEs and how severe those CVEs are, which is the closest thing to ranking CWEs.
From a defender's view, lower is better: scores below 4.0 are low severity and 9.0 or above are critical. But a score alone does not decide urgency. Combine it with exploitation evidence from CISA KEV, EPSS probability and how exposed and important the affected system is in your environment.
Not necessarily. Vulnerabilities in CISA's KEV catalog, which are known to be exploited, should usually come first, even if their CVSS score is lower. A critical score on an isolated internal system with no known exploitation may wait for the normal cycle. Prioritize by severity, likelihood and exposure together.
Neither is better; they measure different things. CVSS measures how severe a vulnerability would be if exploited. EPSS estimates how likely exploitation is in the next 30 days. FIRST, which maintains both, recommends using them together, alongside your own knowledge of which systems matter most.
The CWE Top 25 is MITRE's yearly list of the most dangerous software weaknesses, ranked using real CVE data on frequency and severity. Common entries include cross-site scripting, out-of-bounds write and SQL injection. Development teams use it to focus secure coding training and code review on the mistakes that matter most.
